Malware Analysis Report

2024-09-23 02:53

Sample ID 240708-kzvbvstgpc
Target ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d
SHA256 ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d
Tags
stormkitty xworm rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d

Threat Level: Known bad

The file ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d was found to be: Known bad.

Malicious Activity Summary

stormkitty xworm rat stealer trojan

StormKitty payload

StormKitty

Detect Xworm Payload

Xworm

Checks computer location settings

Drops startup file

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-08 09:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-08 09:02

Reported

2024-07-08 09:05

Platform

win7-20240704-en

Max time kernel

147s

Max time network

129s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d.vbs"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2920 wrote to memory of 2288 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 2288 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 2288 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 2288 wrote to memory of 2628 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2628 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2628 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2628 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2628 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2628 wrote to memory of 2976 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2288 wrote to memory of 1448 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 1448 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 1448 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1448 wrote to memory of 1948 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1448 wrote to memory of 1948 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1448 wrote to memory of 1948 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2288 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2316 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 1816 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 1816 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 1816 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1816 wrote to memory of 2556 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1816 wrote to memory of 2556 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1816 wrote to memory of 2556 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2316 wrote to memory of 1924 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2316 wrote to memory of 1924 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2316 wrote to memory of 1924 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2288 wrote to memory of 2068 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2068 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2068 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2068 wrote to memory of 2408 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2068 wrote to memory of 2408 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2068 wrote to memory of 2408 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2288 wrote to memory of 2680 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2680 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 2680 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2680 wrote to memory of 2988 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2680 wrote to memory of 2988 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2680 wrote to memory of 2988 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 2288 wrote to memory of 108 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 108 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 2288 wrote to memory of 108 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 108 wrote to memory of 1304 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 108 wrote to memory of 1304 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 108 wrote to memory of 1304 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d.vbs"

C:\Windows\system32\taskeng.exe

taskeng.exe {AF9E3122-6734-4BA3-B916-E452C6D3F4CE} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\asy3.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2628" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1448" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SearchTrace.mp4"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "1816" "1136"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2316" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2068" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "2680" "1240"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "108" "1232"

Network

N/A

Files

C:\Users\Admin\asy3.vbs

MD5 ecd56d423345d25d32d6894da7ea9a41
SHA1 fa194094d6f86b76b9ea51cbee26ea2bd93d8852
SHA256 01d5fd9a203634b7d45a547cdf72a1edcd601340f37892c324b5f842b22c7b73
SHA512 a6d4550a2bd57be7cd3b50754d2826a100a844553e2a4308366cdd442250989971635d3847add663ec307981e8566f9bd823dece00fac48d085f60336bf5d355

memory/2628-6-0x000000001B590000-0x000000001B872000-memory.dmp

memory/2628-7-0x0000000002810000-0x0000000002818000-memory.dmp

memory/2628-8-0x0000000002D00000-0x0000000002D0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259490813.txt

MD5 5617600fbe45685d3657ae7ab377027d
SHA1 af5b0873cf46f04e7c4b63973947ced8d7ac75c8
SHA256 490b2707751c17726ed7a7cf05e676bc3ffdc16d0db5ea2d5035d6b6f3d75799
SHA512 3af120e2693ca9f288193ea91e2b5711faa3d9315dda31ea7915ff18b1abcce23a03ac35044d8d9aec1890023f8acf9c8bffcd9de1003be6341f0fee1d4eef57

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ecf1a795872df4bc35a4f70e9cdad29e
SHA1 6905fe33e312ceac49a5c6f85216ea5049a973eb
SHA256 96294cd51b2a6d9b28fa3bac09af671e27240a6af1f4f43367fb29110721a939
SHA512 79ffd08247f2b14c0dc43b065b60bf1cf2c8125f4a33a1b16b464040d1d2a448710e279f6710d03a0a579101267b426497fbacd7ddd52f79530eabfcc7735545

memory/1448-16-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

memory/1448-17-0x00000000027B0000-0x00000000027B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259506479.txt

MD5 2b3a482a66e9bb3dd4b54798c4650b41
SHA1 408aaab69b8169bd0587f7bddfd34a396edcd12f
SHA256 253b799bd78eb65640d0a412ec8fd44771b5731fac99b305c1cc8570a5c0065e
SHA512 9c0fc5523b4caa6c14c173c75cbcd93eae96d191e33e168bd1431c21a7ddb466f0900a577d83a69173b30576e71640425f61e1a2a4fff4f14943c4747f6138c5

memory/2144-31-0x000007FEF7060000-0x000007FEF7094000-memory.dmp

memory/2144-30-0x000000013F920000-0x000000013FA18000-memory.dmp

memory/2144-34-0x000007FEF80D0000-0x000007FEF80E7000-memory.dmp

memory/2144-33-0x000007FEFA840000-0x000007FEFA858000-memory.dmp

memory/2144-35-0x000007FEF7270000-0x000007FEF7281000-memory.dmp

memory/2144-36-0x000007FEF6E50000-0x000007FEF6E67000-memory.dmp

memory/2144-37-0x000007FEF6D20000-0x000007FEF6D31000-memory.dmp

memory/2144-39-0x000007FEF6C60000-0x000007FEF6C71000-memory.dmp

memory/2144-38-0x000007FEF6C80000-0x000007FEF6C9D000-memory.dmp

memory/2144-32-0x000007FEF5A80000-0x000007FEF5D36000-memory.dmp

memory/2144-40-0x000007FEF0600000-0x000007FEF080B000-memory.dmp

memory/2144-44-0x000007FEF2210000-0x000007FEF2228000-memory.dmp

memory/2144-46-0x000007FEF21D0000-0x000007FEF21E1000-memory.dmp

memory/2144-47-0x000007FEF21B0000-0x000007FEF21C1000-memory.dmp

memory/2144-45-0x000007FEF21F0000-0x000007FEF2201000-memory.dmp

memory/2144-43-0x000007FEF2230000-0x000007FEF2251000-memory.dmp

memory/2144-42-0x000007FEF2260000-0x000007FEF22A1000-memory.dmp

memory/2144-48-0x000007FEF2190000-0x000007FEF21AB000-memory.dmp

memory/2144-49-0x000007FEF2170000-0x000007FEF2181000-memory.dmp

memory/2144-50-0x000007FEF1D80000-0x000007FEF1D98000-memory.dmp

memory/2144-51-0x000007FEF1D50000-0x000007FEF1D80000-memory.dmp

memory/2144-52-0x000007FEF1CE0000-0x000007FEF1D47000-memory.dmp

memory/2144-54-0x000007FEF1CC0000-0x000007FEF1CD1000-memory.dmp

memory/2144-56-0x000007FEF1C90000-0x000007FEF1CB8000-memory.dmp

memory/2144-57-0x000007FEF14C0000-0x000007FEF14E4000-memory.dmp

memory/2144-55-0x000007FEF14F0000-0x000007FEF1547000-memory.dmp

memory/2144-53-0x000007FEF1550000-0x000007FEF15CC000-memory.dmp

memory/2144-58-0x000007FEF1C70000-0x000007FEF1C88000-memory.dmp

memory/2144-59-0x000007FEF1490000-0x000007FEF14B3000-memory.dmp

memory/2144-60-0x000007FEF05E0000-0x000007FEF05F1000-memory.dmp

memory/2144-61-0x000007FEF05C0000-0x000007FEF05D2000-memory.dmp

memory/2144-41-0x000007FEED9D0000-0x000007FEEEA80000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259538591.txt

MD5 b49310fa4fc67f8003cba53cc2ba860c
SHA1 f61f50947a8011997f2c9986838b41cff5ae6eac
SHA256 a634e0883408c93b533c04a1fa199fc272bc7ccdd0decf76ca27a2809a664f6c
SHA512 5091c82c04d602805d4383c305dcd56c7076e6b52a3fe3eb3f3f974a5ee6b93e2450782ee092e9cb7fc5dbf7a434af9f501df54f133884a62c4a276b33e65520

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259534987.txt

MD5 3c338ec4d5dca6dd470095c2871c8609
SHA1 af9511323aebbb29e39c9669ac79a9ca3ff96780
SHA256 0aa40c53dcc1abdc15bd4649e8ae852ee785291edc66d8756bb34deb37f30990
SHA512 a48213349d96abd18925305867341596853797ea5e5cde7fc71d9ce0f0355c604978b88b65e07b3d811d06f69fdb8b6af59f1446a1a5a0bde563f17f4703f2b1

memory/2144-83-0x000007FEED9D0000-0x000007FEEEA80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259554651.txt

MD5 2160e9fa192931bb7b3bc445d6b3c0c9
SHA1 ab150e1a1ceee4839658e03303170e6a9b57ec06
SHA256 2b9782b05f366b07e4b1bedb538366588b2d7e2c350115e6f31f3872ac34514e
SHA512 a780884e93d1ef9b2cc8425f67a59c675594722901908d989f224c377e13cb59f3035a7f8264300c3c78c891d4546b614a75054260a07a156e3d987e635773ca

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259564799.txt

MD5 44c59a3fa2b272ece4e432de5eb907ba
SHA1 16a4d8218afa8b4d42902aa9235d71d6b5875ba9
SHA256 64b5372cc203cf9e6e482a71d812adf4a12ff320d5bc1a9540d87064c2c9faae
SHA512 33008fd88f8d21423e249330a06d20bf2ea8f6c61f6ea387c46f4e791272bf0a0c0e7609f682ebb719443ce730bb163ec4ae20af269f4500c0b3bc0170305f54

C:\Users\Admin\AppData\Local\Temp\OutofProcReport259582971.txt

MD5 7fd5279a0b3df6cbfc24c191b8cfb074
SHA1 f39084897a352084586ec4caa41b74b15cf7309b
SHA256 d4eda2b355fdff8c9bd61cc20a771e8ff6ad7423fb6062fa5ee666c414ea5417
SHA512 9f5b1c070ae8d52018159524d588ba2693d4656c113f7d0d33ddb78bb2dc848191a57d4b8abe2deb64fb0840711c4c0bb3696345648221938b43c7c10f0b143b

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-08 09:02

Reported

2024-07-08 09:05

Platform

win10v2004-20240704-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d.vbs"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wermgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\wermgr.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\wermgr.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1848 wrote to memory of 4360 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1848 wrote to memory of 4360 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1848 wrote to memory of 864 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1848 wrote to memory of 864 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4360 wrote to memory of 4308 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 4308 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 4308 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 3176 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 3176 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 3176 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4360 wrote to memory of 448 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 864 wrote to memory of 1828 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 864 wrote to memory of 1828 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4360 wrote to memory of 208 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4360 wrote to memory of 208 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 1848 wrote to memory of 4068 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 1848 wrote to memory of 4068 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4764 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 4764 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 4764 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 4964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 4964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 4964 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 3380 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 4068 wrote to memory of 624 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe
PID 4068 wrote to memory of 624 N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\wermgr.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea21df3506bd3e847b7d8c8b17ab681431ea616d48fc67e58352bc187fe81f7d.vbs"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2740,i,4226873509039249198,15952596839998010243,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\Users\Admin\asy3.vbs"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StepSuspend.mp3"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "864" "2692" "2616" "2696" "0" "0" "2700" "0" "0" "0" "0" "0"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4360" "2796" "2740" "2800" "0" "0" "2804" "0" "0" "0" "0" "0"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 448 -ip 448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 2080

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\system32\wermgr.exe

"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4068" "2764" "2700" "2768" "0" "0" "2772" "0" "0" "0" "0" "0"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 51.170.16.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 fudisa.com udp
FR 194.59.31.74:58538 fudisa.com tcp
US 8.8.8.8:53 74.31.59.194.in-addr.arpa udp
FR 194.59.31.74:58538 fudisa.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\asy3.vbs

MD5 ecd56d423345d25d32d6894da7ea9a41
SHA1 fa194094d6f86b76b9ea51cbee26ea2bd93d8852
SHA256 01d5fd9a203634b7d45a547cdf72a1edcd601340f37892c324b5f842b22c7b73
SHA512 a6d4550a2bd57be7cd3b50754d2826a100a844553e2a4308366cdd442250989971635d3847add663ec307981e8566f9bd823dece00fac48d085f60336bf5d355

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojuqacpz.rmo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4360-13-0x0000020A47D40000-0x0000020A47D62000-memory.dmp

memory/4360-14-0x0000020A4A320000-0x0000020A4A364000-memory.dmp

memory/4360-15-0x0000020A4A3F0000-0x0000020A4A466000-memory.dmp

memory/2076-22-0x00007FFDFFE60000-0x00007FFDFFE94000-memory.dmp

memory/2076-21-0x00007FF730B10000-0x00007FF730C08000-memory.dmp

memory/2076-29-0x00007FFDFF950000-0x00007FFDFF96D000-memory.dmp

memory/2076-28-0x00007FFDFFB10000-0x00007FFDFFB21000-memory.dmp

memory/2076-23-0x00007FFDFA270000-0x00007FFDFA526000-memory.dmp

memory/2076-25-0x00007FFE00F70000-0x00007FFE00F87000-memory.dmp

memory/2076-31-0x00007FFDFC7B0000-0x00007FFDFC9BB000-memory.dmp

memory/2076-24-0x00007FFE085D0000-0x00007FFE085E8000-memory.dmp

memory/2076-27-0x00007FFDFFF30000-0x00007FFDFFF47000-memory.dmp

memory/2076-26-0x00007FFE003E0000-0x00007FFE003F1000-memory.dmp

memory/2076-30-0x00007FFDFF1D0000-0x00007FFDFF1E1000-memory.dmp

memory/2076-33-0x00007FFDFCB40000-0x00007FFDFCB81000-memory.dmp

memory/2076-39-0x00007FFDF9D60000-0x00007FFDF9D71000-memory.dmp

memory/2076-38-0x00007FFDFC770000-0x00007FFDFC781000-memory.dmp

memory/2076-37-0x00007FFDFC790000-0x00007FFDFC7A1000-memory.dmp

memory/2076-36-0x00007FFDFCB20000-0x00007FFDFCB31000-memory.dmp

memory/2076-35-0x00007FFDFF1B0000-0x00007FFDFF1C8000-memory.dmp

memory/2076-34-0x00007FFDFDF30000-0x00007FFDFDF51000-memory.dmp

memory/2076-32-0x00007FFDE4860000-0x00007FFDE5910000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 b1ce13687a525f1669c47071658c442b
SHA1 60c92f59af276b6f875e84d7d6274f73c381ac22
SHA256 70c56088dc110dbc21fd3e60d138fb0bdc56bbbbfe4827955b26eed7d5fae7da
SHA512 064231a27f7ecc4ec5393cd058daf9fe929b3b6d89a0c520e5391e0b45b76eb7eaec5307c13d34edefc7b3c625822f730f11f1e4a6cf702fd26156d0d49245aa

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 3365dd824d2b8c6b4e97089d1baad266
SHA1 c3d896f0a530dff7121f2ea35870821dfebf4bf8
SHA256 43c877b84ae448084180d95e3016fdadda2dc5c70baa6d424ad1502fd5fe20ab
SHA512 6c34dbbab1870a2359ef129747c70611f2de33f913d8199c9798c3b468c4e5b8ac4ffd418dbe86224de350b1d14fe32c008fdcadaf63cd669890795811b52377

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/4360-58-0x0000020A47D90000-0x0000020A47D9A000-memory.dmp

memory/4360-59-0x0000020A4A310000-0x0000020A4A31C000-memory.dmp

memory/448-60-0x0000000000400000-0x0000000000418000-memory.dmp

memory/448-76-0x0000000004E50000-0x0000000004EEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6e809f4c18466a0a63db912fb7a2441c
SHA1 d88653e1426406c3175c3fee38d55cd94a1ec5b1
SHA256 2a684a0f36716559ec3fef1d5cdcd0fa7d48cd59e40457b7adc4d7b1f9a0c9fa
SHA512 b47bb55f42d8930277dcab4d3850aba5b1f40b794f07cf1a0858b7280dc8bab243f445c50d2a45fa183c8f664c4864f476d4565c85380fc10cf45fe53d16100c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

memory/448-84-0x0000000005B10000-0x00000000060B4000-memory.dmp

memory/448-85-0x0000000006160000-0x00000000061F2000-memory.dmp

memory/448-86-0x0000000005AC0000-0x0000000005ACA000-memory.dmp

memory/2076-98-0x00007FFDE4860000-0x00007FFDE5910000-memory.dmp

memory/448-106-0x0000000006200000-0x0000000006266000-memory.dmp

memory/448-107-0x00000000062B0000-0x00000000062BE000-memory.dmp

memory/448-108-0x0000000006E80000-0x0000000006F9E000-memory.dmp

memory/448-109-0x0000000006FE0000-0x0000000007334000-memory.dmp

memory/448-110-0x0000000007390000-0x00000000073DC000-memory.dmp

memory/2076-157-0x00007FFDE4860000-0x00007FFDE5910000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 1510fd7fd46e8fda5ddb480f524b46d8
SHA1 03a012cafeb2cd275da75fcc1867e17f0f16d723
SHA256 4dab053aaf011d6808c60a641915225173f108f044a1ec5b9256b566821cfbbb
SHA512 4957b28ef3ce80b629829c2efc86a024d82b727c71b50e8256e73215ebc6f1a3d7b8ecc6a96bed9bf81c9dff77de02108f2f2aade4224312e5b5c5ecc7991ace

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

MD5 dc0fc3b1d8dfb2151af683c5fe9128be
SHA1 7ff31e4cc5589bc38031b986f3c54fe94435a265
SHA256 8b5d267bf8af05b8181abe36234fae9b9ce19a06875fc09b62d7b88240e5820a
SHA512 e694e1fcc26bd7899aeaca448fefdf1f283003889d4a6f8673b092e8968b4afdfc1c16d72c5e22da60c16cbebe28477bc71a6efe551b17e9b5948011fd0a7ff2

C:\Users\Admin\AppData\Roaming\Notepad++.exe

MD5 9827ff3cdf4b83f9c86354606736ca9c
SHA1 e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256 c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA512 8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad++.lnk

MD5 fbd01e7c96e2ed34b5fecafc1a2da4eb
SHA1 ec68e4908d23a6eee67ecff5ef7b5620d2d2f068
SHA256 768179aa2b76794c6ddaa22c0fed3c5c441fcc0d07b39ad2ccecc5bbda2913a5
SHA512 6c9857cabf487e505d96e8061a45da99aedbe6db6bcc07c359c15845df69bf784c2b628c0930e3fb569c4f77e40fb14ad8cf497eba9ebb2fb21adb3a3ee7c78b